@kuratchi/js 0.0.17 → 0.0.18

package/dist/compiler/index.js

@@ -18,7 +18,7 @@ import { prepareRootLayoutSource } from './root-layout-pipeline.js';
 import { generateRoutesModule as generateRoutesModulePipeline } from './routes-module-pipeline.js';
 import { assembleRouteState } from './route-state-pipeline.js';
 import { createServerModuleCompiler } from './server-module-pipeline.js';
-import { buildWorkerEntrypointSource, resolveRuntimeImportPath as resolveRuntimeImportPathPipeline, } from './worker-output-pipeline.js';
+import { buildCompatEntrypointSource, buildWorkerEntrypointSource, resolveRuntimeImportPath as resolveRuntimeImportPathPipeline, } from './worker-output-pipeline.js';
 import { syncWranglerConfig as syncWranglerConfigPipeline } from './wrangler-sync.js';
 import { filePathToPattern } from '../runtime/router.js';
 import * as fs from 'node:fs';
@@ -294,6 +294,7 @@ export async function compile(options) {
         fs.mkdirSync(outDir, { recursive: true });
     }
     writeIfChanged(outFile, output);
+    writeIfChanged(path.join(outDir, 'routes.js'), buildCompatEntrypointSource('./routes.ts'));
     // Generate .kuratchi/worker.ts — the stable wrangler entry point.
     // routes.ts already exports the default fetch handler and all named DO classes;
     // worker.ts explicitly re-exports them so wrangler.jsonc can reference a
@@ -305,6 +306,7 @@ export async function compile(options) {
         doClassNames: doConfig.map((entry) => entry.className),
         workerClassEntries: [...agentConfig, ...containerConfig, ...workflowConfig],
     }));
+    writeIfChanged(path.join(outDir, 'worker.js'), buildCompatEntrypointSource('./worker.ts'));
     // Auto-sync wrangler.jsonc with workflow/container/DO config from kuratchi.config.ts
     syncWranglerConfigPipeline({
         projectDir,

package/dist/compiler/worker-output-pipeline.d.ts

@@ -11,3 +11,4 @@ export declare function buildWorkerEntrypointSource(opts: {
     doClassNames: string[];
     workerClassEntries: WorkerClassExportEntry[];
 }): string;
+export declare function buildCompatEntrypointSource(targetFile: string): string;

package/dist/compiler/worker-output-pipeline.js

@@ -35,3 +35,11 @@ export function buildWorkerEntrypointSource(opts) {
         '',
     ].join('\n');
 }
+export function buildCompatEntrypointSource(targetFile) {
+    return [
+        '// Auto-generated by kuratchi — do not edit.',
+        `export { default } from '${targetFile}';`,
+        `export * from '${targetFile}';`,
+        '',
+    ].join('\n');
+}

package/dist/create.js

@@ -278,7 +278,7 @@ function genPackageJson(opts) {
 function genWrangler(opts) {
     const config = {
         name: opts.name,
-        main: '.kuratchi/worker.js',
+        main: '.kuratchi/worker.ts',
         compatibility_date: new Date().toISOString().split('T')[0],
         compatibility_flags: ['nodejs_compat'],
     };

package/dist/runtime/security.js

@@ -32,6 +32,7 @@ export function initCsrf(request, cookieName = CSRF_COOKIE_NAME) {
     }
     __setLocal('__csrfToken', token);
     __setLocal('__csrfCookieName', cookieName);
+    __setLocal('__csrfCookieSecure', shouldUseSecureCookie(request));
     return token;
 }
 /**
@@ -94,9 +95,10 @@ export function getCsrfCookieHeader() {
     }
     const token = locals.__csrfToken;
     const cookieName = locals.__csrfCookieName || CSRF_COOKIE_NAME;
+    const secure = locals.__csrfCookieSecure ? '; Secure' : '';
     // SameSite=Lax allows the cookie to be sent on top-level navigations
     // HttpOnly=false so client JS can read it for fetch requests
-    return `${cookieName}=${token}; Path=/; SameSite=Lax; Secure`;
+    return `${cookieName}=${token}; Path=/; SameSite=Lax${secure}`;
 }
 // ── RPC Security ───────────────────────────────────────────────────
 const RPC_NONCE_LENGTH = 16;
@@ -191,6 +193,18 @@ function parseCookies(header) {
     }
     return map;
 }
+function shouldUseSecureCookie(request) {
+    const forwardedProto = request.headers.get('x-forwarded-proto');
+    if (forwardedProto) {
+        return forwardedProto.split(',')[0].trim().toLowerCase() === 'https';
+    }
+    try {
+        return new URL(request.url).protocol === 'https:';
+    }
+    catch {
+        return false;
+    }
+}
 function isSameOrigin(request, url) {
     const fetchSite = request.headers.get('sec-fetch-site');
     if (fetchSite && fetchSite !== 'same-origin' && fetchSite !== 'same-site' && fetchSite !== 'none') {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@kuratchi/js",
-    "version": "0.0.17",
+    "version": "0.0.18",
     "description": "A thin, Cloudflare Workers-native web framework with Svelte-inspired syntax",
     "license": "MIT",
     "type": "module",